Stories
Slash Boxes
Comments

SoylentNews is people

Compromise Desktop Linux Using SNES Processor Opcodes

posted by CoolHand on Wednesday December 14 2016, @05:26AM   Printer-friendly
from the all-fun-n-games-until-someone-gets-cracked dept.

tonyPick writes:

A fascinating article on how to compromise a Linux desktop using Super Nintendo Entertainment System (SNES) processor opcodes:

TL;DR: full reliable 0day drive-by exploit against Fedora 25 + Google Chrome, by breaking out of Super Nintendo Entertainment System emulation via cascading side effects from a subtle and interesting emulation error.

The fault is built around the fact that the Linux gstreamer media playback framework supports playback of SNES music files by.... emulating the SNES CPU and audio processor, and the processor emulation has some exploitable vulnerabilities. The author (Chris Evans) then describes the process of working out how to escalate this into a full exploit in complete (and fascinating) detail.

Also, to quote from the article:

As always, the general lack of sandboxing here contributes to the severity. I think we inhabit a world where media parsing sandboxes should be mandatory these days. There's hope: some of my other recent disclosures appear to have motivated a sandbox for Gnome's tracker.

The processor in question is The Ricoh 5A22, a derivative of the 6502 processor, built specifically for the SNES the Sony SPC700 audio processor, not the Ricoh 5A22. [Ed: thanks KritonK for the update]

Original Submission

 
This discussion has been archived. No new comments can be posted.
Compromise Desktop Linux Using SNES Processor Opcodes | Log In/Create an Account | Top | 16 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 5, Informative) by KritonK on Wednesday December 14 2016, @09:22AM

    by KritonK (465) on Wednesday December 14 2016, @09:22AM (#441214)

    From TFA:

    [UPDATE 13 Dec 2016 -- a couple of competent readers inform me that I've named the wrong processor! The actual emulated processor where the fault lies is the Sony SPC700, not the Ricoh 5A22. Whoops. The SPC700 is exclusively an audio co-processor. The 5A22, which is not emulated by Game Music Emu, is the main processor.]

    Starting Score:    1  point
    Moderation   +4  
       Informative=4, Total=4
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   5